What is your security setup these days?

W.10 Home x64 22H2
Local Account - Standard user - Limited permissions
UAC maximum - Always notify
Cloudflare DNS
Onedrive,Cortana,Advertising ID,Web Search - disabled
Usage of location data for Cortana disabled
Telemetry OFF
Removed some Windows optional features.

Microsoft Defender Firewall hardened with H_C.
Microsoft Defender hardened with Configure Defender (Customized level) - Cloud Block Level

• Ransomware protection - disabled
• No run in a sandbox
• Core Isolation: Memory integrity - disabled
• Some softwares hardened with maximum AE protection
• All Windows Exploit Protection options - enabled

MS Edge --disable-webgl --no-pings

• Home page: https://start.duckduckgo.com/
• Search engine = only DDG
• Enabled Security Mitigations - Strict
• Detection Protection - Strict
• Clipboard permissions - blocked
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Share browsing data with other Windows features - disabled
• Blocked cookies (also third parties):
  
  Code:

  abrahamjuliot.github.io
  ntp.msn.com
  c.msn.com
  assets.msn.com
  msn.com
  microsoftedge.microsoft.com
  fpt2.microsoft.com
  browserleaks.com

Policies:

• AutomaticHttpsDefault = 2
• BrowserSignin = 0
• HideFirstRunExperience - true
• DnsOverHttpsMode = secure
• DnsOverHttpsTemplates = Next DNS
• TLSCipherSuiteDenyList = "0x002f","0x0035","0xc013","0x009c","0xc014","0x009d"
• HubsSidebarEnabled - false
• SyncDisabled - true
• AudioSandboxEnabled - true
• NetworkServiceSandboxEnabled - true
• Edge3PSerpTelemetryEnabled - false
• AllowSurfGame - false
• ExtensionManifestV2Availability= 2
• WebWidgetAllowed - false
• ShowRecommendationsEnabled - false
• ShowDownloadsInsecureWarningsEnabled = true
• ManagedSearchEngines = [{"allow_search_engine_discovery":false},{"is_default":true,"name":"DuckDuckGo","keyword":"duckduckgo.com","search_url":"https://duckduckgo.com/?q={searchTerms}","suggest_url":"https://www.duckduckgo.com/qbox?query={searchTerms}","image_search_url":"https://www.duckduckgo.com/images/detail/search?iss=sbiupload"}]
• ReadAloudEnabled - false

Edge://flags:

Enabled:

• Block scripts loaded via document.write
• TLS 1.3 Early Data
• Block insecure private network requests.
• Parallel downloading
• Show block option in autoplay settings
• Experimental Tracking Prevention Features
• Project Robin experiment
• New PDF Viewer
• Strict-Origin-Isolation
• Back-forward cache - Enabled force caching all page
• Origin-keyed Agent Clusters by default
• Origin-keyed Processes by default
• Bind cookies to their setting origin's port
• Bind cookies to their setting origin's scheme

Extensions:

• uBlock Origin Hard Mode with TLD's
• AdGuard AdBlocker v.5.x.x. Hard Mode with TLD's - off by default
• Stream Recorder - off by default
• Video DownloadHelper - off by default

Firefox

• Home page: https://start.duckduckgo.com/
• Search engine = only DDG
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Tracking protection: Strict
• DNS over HTTPS : Max Protection
• HTTPS-only-mode enabled
• Pocket disabled
• Clearing browsing data on exit
• Firefox telemetry disabled
• Protection against fraudulent content and dangerous software enabled - all enabled
• Some FastFox.js settings
• Some Arkenfox.js settings

Policies

• OverridePostUpdatePage set to ""
• DontCheckDefaultBrowser = true
• OverrideFirstRunPage set to ""

Extensions

• uBlock Origin - Hard Mode with TLD's
• Video DownloadHelper - off by default
• HLS Downloader - off by default

 

Windows related

• Windows 10 1809 LTSC
• Local account
• All telemetry removed (NTlite)
  
• Windows defender deleted (AVG + Malwarebytes AE)
• Windows TaskScheduler deleted (Xstarter with password protection)
• Windows LogViewer deleted (Nirsoft logviewer)
• WFW hardened (white lists for both outbound and inbound connections, registry tweaks)
• Hard link for svchost (svchost-wan) for the services which connect to other machines either in LAN or in WAN.
• Many tweaks from Atlant Security Windows 10 Security Hardening Script
• Powershell - only signed scripts allowed in GP
  
• Other minor security tweaks (like, special ACL permissions for all RUN sections in registry, etc)

Other

• AVG with ransomware protection of the documents folder. White list.
• MalwareBytes Anti-Exploit protection
• Dnscrypt-proxy with only anti-malware servers included. Blocklist is used and updated daily
• Firefox and Thunderbird hardened with arkenfox user.js + uBlock (all scripts and 3d-party frames are blocked by default)
  
• PGP keyring using GPG4WIN for passwords management (instead of apps like keypass) and SSH connections

 

Windows 10 (AtlasOS)

• disabled Windows Defender

Malwarebytes Windows Firewall Control
Simple DNSCrypt
Google Chrome (DuckDuckGo Privacy Essentials + WebRTC Control)
Keyscrambler Personal
Easeus Todo Backup Free

 

As far as I know Andy_Ful doesn't promote using WHHLight together with apps like OS Armor (BTW, nothing against this app).

 

Windows 11 (Atlas OS)

• disabled Windows Defender
• SpyShelter Ultimate
• some additional privacy&telemetry fixes etc. with https://github.com/ChrisTitusTech/winutil & https://github.com/hellzerg/optimizer
• uBlock Origin Chrome add-on - but thx to Google will have to change (maybe AdGuard for Windows?)
• Hasleo Backup Suite
• GlassWire Elite
• Appcheck Free by CheckMAL
• Bitwarden

 

I removed them both now

 

And you didn't enable WD Defender?

 

yes.

 

Windows 10 (AtlasOS | Disabled Windows Defender)

• SimpleDNSCrypt
• Malwarebytes Windows Firewall Control
• Malwarebytes Anti-Exploit Beta
• Appcheck by CheckMAL
• Google Chrome (Adguard Adblocker + Privacy Badger)
• Keyscrambler Personal
• Easeus Todo Backup Free

​

 

On first main computer :

Eset smart security premium + OsArmor + Sticky Password + weekly Easeus Todo Backup
Firefox with Ublock Origin + Privacy Badger + Cloudfare dns

On second laptop :

ZoneAlarm NextGen + OsArmor + Sticky Password + monthly Easeus Todo Backup
Firefox with Ublock Origin + Privacy Badger + Cloudfare dns

Light, efficient and sufficient for me.

 

Windows10
Main line of defense.........
Sphinx Firewall - AppGuard Solo - KeyScrambler - DeepFreeze

Other Software..........
Instant Recovery - Mullvad - Proton Pass - Process Lasso

 

Avira with OSArmor. Just enable all OSarmor "suspicius"
Kinda funny, when testing 0day malware, OSArmor reacts faster while Avira does cloud lookups.

 

f-secure total MBAM ublock

 

Configure Defender, Windows Hybrid Hardening Light, Firewall Hardening.

 

Here it comes, I have adopted the brain is the best defense mentality, so no longer run software on the system that tracks things, scans things etc. automatically in the background. These days some a/v is worse than having malware on your system.

All outbound DNS is forced through my DNS on my hardware firewall, DoH via client devices also blocked, as more and more software is starting to use DoH now to bypass local DNS.
Local DNS has threat filters built on.
Local DNS is forwarding over DoH to NextDNS which also has small amounts of filtering, although not much as I dont want breakage.
Applocker configuration, no global writable folders can run untrusted binaries.
Browser locked down via configuration and ublock origin, umatrix.
Windows hardened via configuration.
Regular backups or remotely stored of anything I care about.
Outbound firewall filtering on Windows managed by WFC.
Phone has local adaway filtering combined with local DNS and NextDNS filtering.
UAC disabled whitelist.
Hardware firewall blocks outbound traffic to known low rep end points. If this logs anything it will be a means of knowing a client is compromised.
All devices I consider risky, phones, any clients not used by me directly as well, go in my guest VLAN, no inter LAN access, and walled garden, throttled internet.

Microsoft's new feature interests me, it feels its a decade too late, but they have killed it before it started by requiring a clean install and no whitelist Microsoft knows best mentality.

 

CFW 12.3.4.8162 (CS settings)
UAC disabled
just wondering whether ConfigureDefender would be of any benefit with this setup?

 

Not really, except possibly to your comfort level.

 

Windows 11 Pro (23H2)

Firewall & Anti-Virus
Router NAT/SPI (Password Protected)
Windows Defender Firewall
Malwarebytes Premium 5.2.4.157

Blocking/Hardening
AppGuard 6.7.129.2
HitmanPro.Alert 3.8.26 Build 983
Quad9 DNS

 

aah right.. cheers.

 

Windows 11 23H2

Backup: Macrium Reflect
Antimalware: Eset Nod32 Antivirus
Content blocker: uBlock Origin

 

CFW 12.3.4.8162 (CS settings)
UAC disabled
ConfigureDefender=High

 

Windows10
Main line of defense.........
Sphinx Firewall - AppGuard Solo - KeyScrambler - DeepFreeze

Other Software..........
Instant Recovery - AdGuard - AdGuard VPN - Proton Pass - Process Lasso

 

Code:

assoc .exe=txtfile

 

Same old boring setup: Configure Defender, Windows Hybrid Hardening Light, Firewall Hardening, UBO, Bitdefender Trafficlight.